sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fleet-manager: auto-renew the agent-plane server cert (step-ca sidecar + hot-reload)

Browse Source 
The agent-plane server cert was issued by hand (server-pki.sh / docker exec
step ca certificate), which needs the step CLI on the host, re-specifies SANs
each time, and silently expires at the CA's 90-day cap — the exact failure that
just broke agent TLS (cert minted with a stale SAN, missing manager.fleet.lab).

Automate it:
- agent-cert-renewer sidecar (smallstep step-cli image, compose profile
  cert-auto): issues the cert once from the co-located fleet step-ca, then
  'step ca renew --daemon' rotates it before the cap. Renewal preserves the
  subject + SANs, so SAN drift cannot recur. Chowns to the manager's nonroot
  uid so the distroless manager reads the key. Opt-in + only valid where the CA
  is co-located; server-pki.sh stays as the manual/remote-CA path.
- manager hot-reloads via GetCertificate (certreload.go): a rotated cert on
  disk is picked up on the next handshake with no restart and no dropped agent
  streams; a half-written pair keeps the last good cert serving. Unit-tested.
- defaults.env documents the cert-auto knobs; DEPLOY.md §2a recommends the
  renewer and flags the mandatory manager.fleet.lab SAN.
This commit is contained in:
Audiobuzz
2026-07-10 07:42:18 +00:00
parent 1c68c37824
commit 1db3977238
8 changed files with 360 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/fleet-manager/defaults.env
+23 -2
View File
@@ -42,10 +42,31 @@ AWS_HOSTED_ZONE_ID=
# --- agent plane (gRPC + mTLS, fleet CA) ---------------------------------------
# Routable mgmt address enrolled hosts dial (":9600" = all interfaces). The
# server cert is issued by the fleet CA (server-pki.sh); the client CA is the
# fleet root so host TPM certs verify. Paths are fixed in docker-compose.yml.
# server cert is issued by the fleet CA (server-pki.sh, or the auto-renewer
# below); the client CA is the fleet root+intermediate so host TPM certs verify.
# Paths are fixed in docker-compose.yml.
FLEET_MGR_AGENT_ADDR=:9600
# --- agent-plane cert auto-renewer (compose profile: cert-auto) ----------------
# Only used when you run the `agent-cert-renewer` sidecar (step-ca co-located on
# this host). It issues the server cert once, then auto-renews before the CA cap,
# preserving the SANs. Defaults suit the bench; override host paths in .env if
# your step-ca lays out its PKI differently.
# AGENT_CERT_SANS all names hosts dial (first = CN). manager.fleet.lab
# is the fleet-DNS name; keep the host FQDN too.
# AGENT_CA_URL the co-located fleet step-ca (host-loopback).
# AGENT_CERT_NOT_AFTER first-issue lifetime (<= CA max, currently 2160h).
# AGENT_CERT_RENEW_EXPIRES_IN renew when less than this remains.
# FLEET_CA_ROOT / _INTERMEDIATE / _PROVISIONER_PW host paths to the CA material.
AGENT_CERT_SANS=manager.fleet.lab,diskless-server.bitasylum.org
AGENT_CA_URL=https://localhost:8443
AGENT_CERT_NOT_AFTER=2160h
AGENT_CERT_RENEW_EXPIRES_IN=720h
FLEET_CA_PROVISIONER=enrol
FLEET_CA_ROOT=../dot1x-bench/pki/root_ca.crt
FLEET_CA_INTERMEDIATE=../dot1x-bench/pki/intermediate_ca.crt
FLEET_CA_PROVISIONER_PW=../dot1x-bench/pki/stepca/secrets/password
# --- authorise pillar (enrol-broker admin plane over mTLS) ---------------------
# The broker runs network_mode:host on 127.0.0.1:9443. The manager's client cert
# is minted by ../enrol-broker/admin-pki.sh (admin CA), into ./pki/broker/ .